A security product line from VOJO
AI-assisted managed detection & response for European SMEs.
We turn security telemetry, offensive test results and risk data into continuous, prioritised defence — with documented effect, European data sovereignty and a human in control of every action.
Early access: Sentinel Nord is in pre-release development. Response actions run in simulated mode until each adapter is certified, demo environments use synthetic data only, and external AI stays disabled for a tenant until a data processing agreement is in place. We are looking for a small number of design partners.
Connectors for Microsoft Entra ID, Microsoft 365, Defender for Endpoint, EDR webhooks and syslog/CEF. Telemetry is normalised to the Elastic Common Schema in per-tenant data streams.
Every alert is enriched with asset criticality, identity context, geo/ASN, threat intelligence, behavioural baselines and MITRE ATT&CK mapping, and receives a risk score that shows how it was reached.
An AI triage agent drafts a conclusion and recommended actions as structured output, from pseudonymised context. Every AI decision is stored and traceable, and nothing invasive happens without approval.
Six SOAR playbooks — phishing, suspicious sign-in, endpoint malware, data exfiltration, privileged misuse and IP blocking — behind an approval gateway (automatic, SOC, or SOC plus customer) with dry-run and rollback.
Detection rules live in version control and are tested in CI. Findings from offensive testing become a detection gap, a proposed rule (EQL/ES|QL, Sigma), remediation and an automatic retest.
Nine report types, including NIS2 readiness and incident reports that track the Article 23 notification deadlines, mapped to NIS2, ISO/IEC 27001, CIS Controls, GDPR, DORA and TIBER-DK.
AI is decision support. Response actions go through an approval gateway, and every step is written to a hash-chained audit trail that auditors can read but not change.
Database and authentication in Frankfurt, Elasticsearch in an EU region, and language-model calls only to EU-hosted endpoints — and only after the customer has opted in under a data processing agreement.
Row-level security on every table, tenant scope set per database transaction, separate data streams per customer and purpose-bound access for analysts.
NIS2-covered small and mid-sized organisations in Denmark and Europe — energy, manufacturing, logistics, healthcare, SaaS, finance and the public sector — and managed service providers who want to deliver detection and response under their own brand.
Sentinel Nord uses Claude for alert triage. The model sees pseudonymised context, its output is structured and logged, and it cannot execute a response action on its own. When AI is unavailable or disabled, the platform falls back to deterministic triage.
Villads Østergaard, Founder & CEO, VOJO
Sentinel Nord is a product line of VOJO. VOJO · CVR 44541912